Thanks for all your comments!

Is there an argument to be made in favor of either approach as regards security?

I was thinking of a URI component structure that would use each customer's office address/credentials (gathered at sign up) e.g., coolapp.com/john/doe/MD/Newton/MA/02158/